OpenAI says hackers stole some data after latest code security issue

OpenAI has once again demonstrated its commitment to… well, security theatre. Two employees had their devices compromised via a supply chain attack on the TanStack library, a JavaScript utility tool beloved by developers everywhere. The company assures us, in a carefully worded blog post, that no user data or production systems were accessed — which is the cybersecurity equivalent of saying your house was burgled but the silverware is still there.

The breach vector is almost too perfect: a supply chain attack on an open-source library. Because nothing says 'we take safety seriously' quite like having your own staff's laptops pwned through a dependency you probably weren't even tracking. OpenAI is, predictably, vague about what data was stolen — 'some internal documents,' they might say — but we all know the real asset at risk is the narrative. The company that positions itself as the responsible, safety-first lab just got hacked via npm.

This is the same organisation that recently lost its enterprise crown to Anthropic and is facing increasing scrutiny over its data practices. The TanStack incident is a reminder that all the alignment research in the world won't save you if your developers run `npm install` on a compromised package. The gap between OpenAI's lofty rhetoric and its operational security is now a chasm. But hey, at least they disclosed it — eventually.